v2.9.1

Compare Source

What's Changed

Release v2.9.1 by @​h0x0er and @​varunsh-coder in #​440
This release includes two changes:

1. Updated markdown displayed in the job summary by the Harden-Runner Action.
2. Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.

Full Changelog: step-security/harden-runner@v2...v2.9.1

v2.9.0

Compare Source

What's Changed

Release v2.9.0 by @​h0x0er and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/435
This release includes:

• Enterprise Tier - Telemetry Upload Enhancement:
  For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
• Harden-Runner Agent Authentication:
  The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
• README Update:
  A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
• Dependency Update:
  Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

v2.8.1

Compare Source

What's Changed

• Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/425
  The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

v2.8.0

Compare Source

What's Changed

Release v2.8.0 by @​h0x0er and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/416
This release includes:

• File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
• Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

v2.7.1

Compare Source

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in https://github.com/step-security/harden-runner/pull/397
This release:

• Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
• Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
• Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

v2.7.0

Compare Source

What's Changed

Release 2.7.0 by @​varunsh-coder and @​h0x0er in https://github.com/step-security/harden-runner/pull/376
This release:

1. Updates the node runtime to node20
2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

v2.6.1

Compare Source

What's Changed

Release v2.6.1 by @​varunsh-coder and @​h0x0er in https://github.com/step-security/harden-runner/pull/356
This release:

1. Improves the job summary markdown written by the Harden-Runner Action
2. Improves detection of cache endpoint used by the job
3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
4. Updates dependencies

Full Changelog: step-security/harden-runner@v2...v2.6.1

v2.6.0

Compare Source

What's Changed

Release v2.6.0 by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/346

This release adds support for self-hosted Virtual Machine runners (e.g. on EC2).

• Both ephemeral and persistent self-hosted VM runners are supported
• Documentation: https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-vm

Full Changelog: step-security/harden-runner@v2...v2.6.0

v2.5.1

Compare Source

What's Changed

• Updated default allowed endpoints to include *.actions.githubusercontent.com. GitHub Actions recently started making calls to additional sub-domains for this domain. Please update to this latest version of harden-runner to allow these new endpoints.
• Update README.md by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/326
• Bump step-security/harden-runner from 2.4.1 to 2.5.0 by @​dependabot in https://github.com/step-security/harden-runner/pull/327

Full Changelog: step-security/harden-runner@v2...v2.5.1

v2.5.0

Compare Source

What's Changed

Release v2.5.0 by @​h0x0er and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/325

This release:

1. Adds support for Actions Runner Controller (ARC) environment
2. Improves the job summary markdown

Full Changelog: step-security/harden-runner@v2...v2.5.0

v2.4.1

Compare Source

What's Changed

Release v2.4.1 by @​varunsh-coder and @​Devils-Knight in https://github.com/step-security/harden-runner/pull/309

This release

1. Shows a preview of the network events in the job summary markdown
2. Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability

Full Changelog: step-security/harden-runner@v2...v2.4.1

v2.4.0

Compare Source

What's Changed

• Release v2.4.0 by @​varunsh-coder and @​h0x0er in https://github.com/step-security/harden-runner/pull/292
  Adds support for wildcard domains in block mode. e.g. you can add *.data.mcr.microsoft.com:443 to the allowed list, and egress traffic will be allowed to eastus.data.mcr.microsoft.com:443 and westus.data.mcr.microsoft.com:443.
  Link to documentation.
• Bump actions/checkout from 3.5.0 to 3.5.2 by @​dependabot in https://github.com/step-security/harden-runner/pull/277
• Bump github/codeql-action from 2.2.11 to 2.2.12 by @​dependabot in https://github.com/step-security/harden-runner/pull/278
• Bump step-security/harden-runner from 2.3.0 to 2.3.1 by @​dependabot in https://github.com/step-security/harden-runner/pull/282
• Added a workflow for reviewing code changes using stepsecurity code reviewer by @​boahc077 in https://github.com/step-security/harden-runner/pull/290

Full Changelog: step-security/harden-runner@v2...v2.4.0

v2.3.1

Compare Source

What's Changed

• Release v2.3.1 by @​arjundashrath and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/281
  Fixes #​279 and #​275
• Update README.md by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/267
• Bump step-security/harden-runner from 2.2.1 to 2.3.0 by @​dependabot in https://github.com/step-security/harden-runner/pull/268
• Bump codecov/codecov-action from 3.1.1 to 3.1.2 by @​dependabot in https://github.com/step-security/harden-runner/pull/273
• Bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @​dependabot in https://github.com/step-security/harden-runner/pull/265
• Bump actions/checkout from 3.3.0 to 3.5.0 by @​dependabot in https://github.com/step-security/harden-runner/pull/261
• Bump github/codeql-action from 2.2.6 to 2.2.11 by @​dependabot in https://github.com/step-security/harden-runner/pull/270

Full Changelog: step-security/harden-runner@v2...v2.3.1

v2.3.0

Compare Source

What's Changed

• Enable setting policy via insights website (link to documentation) by @​h0x0er and @​varunsh-coder in https://github.com/step-security/harden-runner/pull/266
  The Policy Store helps you manage Harden Runner policies without altering your workflow files.
• Update README.md by @​varunsh-coder in https://github.com/step-security/harden-runner/pull/255
• Bump github/codeql-action from 2.2.4 to 2.2.6 by @​dependabot in https://github.com/step-security/harden-runner/pull/254
• Bump step-security/harden-runner from 2.2.0 to 2.2.1 by @​dependabot in https://github.com/step-security/harden-runner/pull/256

Full Changelog: step-security/harden-runner@v2...v2.3.0